sergiotarxz/Pleroma
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

CommonAPI: Escape HTML for chat messages.

Browse Source
This commit is contained in:
lain 2020-04-16 12:56:29 +02:00
parent 6ace22b56a
commit 3d4eca5dd4
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/pleroma/web/common_api/common_api.ex
View File

@ -17,6 +17,7 @@ defmodule Pleroma.Web.CommonAPI do
alias Pleroma.Web.ActivityPub.Pipeline alias Pleroma.Web.ActivityPub.Pipeline
alias Pleroma.Web.ActivityPub.Utils alias Pleroma.Web.ActivityPub.Utils
alias Pleroma.Web.ActivityPub.Visibility alias Pleroma.Web.ActivityPub.Visibility
alias Pleroma.Formatter
import Pleroma.Web.Gettext import Pleroma.Web.Gettext
import Pleroma.Web.CommonAPI.Utils import Pleroma.Web.CommonAPI.Utils
@ -28,7 +29,12 @@ def post_chat_message(%User{} = user, %User{} = recipient, content) do
transaction = transaction =
Repo.transaction(fn -> Repo.transaction(fn ->
with {_, {:ok, chat_message_data, _meta}} <- with {_, {:ok, chat_message_data, _meta}} <-
{:build_object, Builder.chat_message(user, recipient.ap_id, content)}, {:build_object,
Builder.chat_message(
user,
recipient.ap_id,
content |> Formatter.html_escape("text/plain")
)},
{_, {:ok, chat_message_object}} <- {_, {:ok, chat_message_object}} <-
{:create_object, Object.create(chat_message_data)}, {:create_object, Object.create(chat_message_data)},
{_, {:ok, create_activity_data, _meta}} <- {_, {:ok, create_activity_data, _meta}} <-

11
test/web/common_api/common_api_test.exs
View File

@ -27,7 +27,12 @@ test "it posts a chat message" do
author = insert(:user) author = insert(:user)
recipient = insert(:user) recipient = insert(:user)
{:ok, activity} = CommonAPI.post_chat_message(author, recipient, "a test message") {:ok, activity} =
CommonAPI.post_chat_message(
author,
recipient,
"a test message <script>alert('uuu')</script>"
)
assert activity.data["type"] == "Create" assert activity.data["type"] == "Create"
assert activity.local assert activity.local
@ -35,7 +40,9 @@ test "it posts a chat message" do
assert object.data["type"] == "ChatMessage" assert object.data["type"] == "ChatMessage"
assert object.data["to"] == [recipient.ap_id] assert object.data["to"] == [recipient.ap_id]
assert object.data["content"] == "a test message"
assert object.data["content"] ==
"a test message &lt;script&gt;alert(&#39;uuu&#39;)&lt;/script&gt;"
assert Chat.get(author.id, recipient.ap_id) assert Chat.get(author.id, recipient.ap_id)
assert Chat.get(recipient.id, author.ap_id) assert Chat.get(recipient.id, author.ap_id)